Merge upstream and update generated code for v2479 and 927bdc999cd89e81dfd3b8303986df21a573cf10

Author: stripe-openapi[bot]

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
     branches:
       - master
       - beta
+      - private-preview
       - sdk-release/**
       - feature/**
     tags:

CHANGELOG.md

@@ -26,6 +26,12 @@ This release changes the pinned API version to 2026-08-26.preview.
   * Add support for error codes `authentication_failure`, `capability_not_active`, `expired_payment_method`, `incorrect_postal_code`, `invalid_canceled_subscription_fields`, and `payment_method_restricted` on `QuotePreviewInvoice.last_finalization_error`
 * [#2121](https://github.com/stripe/stripe-php/pull/2121) Add non-verified methods to managed handlers
 
+## 21.3.2 - 2026-09-09
+* [#2142](https://github.com/stripe/stripe-php/pull/2142) Validate that webhook secrets are non-empty
+
+## 21.3.1 - 2026-09-01
+* [#2138](https://github.com/stripe/stripe-php/pull/2138) Harden API requestor code against malicious URLs
+
 ## 21.3.0 - 2026-08-26
 This release changes the pinned API version to 2026-08-26.dahlia.
 

CODEGEN_VERSION

@@ -1 +1 @@
-baff58c9d515cdd5f5c3231d101989d588788c6f
+927bdc999cd89e81dfd3b8303986df21a573cf10

OPENAPI_VERSION

@@ -1 +1 @@
-v2442
+v2479

examples/EventNotificationHandlerEndpoint.php

@@ -15,6 +15,12 @@
 $api_key = getenv('STRIPE_API_KEY');
 $webhook_secret = getenv('WEBHOOK_SECRET');
 
+if (empty($webhook_secret)) {
+    fwrite(STDERR, "WEBHOOK_SECRET environment variable is not set. It should start with `whsec_`\n");
+
+    exit(1);
+}
+
 $app = new Slim\App();
 $client = new Stripe\StripeClient($api_key);
 

examples/EventNotificationWebhookHandler.php

@@ -16,6 +16,12 @@
 $api_key = getenv('STRIPE_API_KEY');
 $webhook_secret = getenv('WEBHOOK_SECRET');
 
+if (empty($webhook_secret)) {
+    fwrite(STDERR, "WEBHOOK_SECRET environment variable is not set. It should start with `whsec_`\n");
+
+    exit(1);
+}
+
 $app = new Slim\App();
 $client = new Stripe\StripeClient($api_key);
 

lib/ApiRequestor.php

@@ -630,6 +630,71 @@ private static function _defaultHeaders($apiKey, $clientInfo = null, $appInfo =
         ];
     }
 
+    /**
+     * Asserts that a request path is origin-relative: that it begins with a
+     * single "/" and carries no scheme, authority or userinfo.
+     *
+     * The absolute URL is built by concatenating the API base onto this path,
+     * and no base URL ends in a slash. A path like "@evil.example/v1/x" or
+     * ".evil.example/v1/x" would modify the resulting host and direct the
+     * request (including the API key) to a non-Stripe host.
+     *
+     * Because some relative urls arrive from potentially untrusted sources (like
+     * webhook bodies), we have to be a little defensive.
+     *
+     * So, we require that a path starts with a leading slash and that
+     * parse_url() finds no scheme or authority in it.
+     *
+     * @param string $url
+     *
+     * @throws Exception\InvalidArgumentException
+     */
+    private static function validatePath($url)
+    {
+        if (!\is_string($url) || '/' !== \substr($url, 0, 1) || '//' === \substr($url, 0, 2)) {
+            throw new Exception\InvalidArgumentException(
+                'Request path must be a string beginning with a single "/".'
+            );
+        }
+
+        $parts = \parse_url($url);
+        if (false === $parts || isset($parts['scheme']) || isset($parts['host']) || isset($parts['user'])) {
+            throw new Exception\InvalidArgumentException(
+                'Request path may not contain a scheme or authority.'
+            );
+        }
+    }
+
+    /**
+     * Rejects CR, LF and NUL in a header name or value.
+     *
+     * Header lines are assembled by concatenation, so a newline in either half
+     * would let the remainder be parsed as additional headers. Some of these
+     * values originate in remote data - fetchRelatedObject() sets Stripe-Context
+     * and Stripe-Request-Trigger from the webhook body - and a per-request
+     * api_key reaches the Authorization value without the whitespace check that
+     * Stripe::setApiKey() applies.
+     *
+     * @param string $header
+     * @param mixed  $value
+     *
+     * @throws Exception\InvalidArgumentException
+     */
+    private static function assertNoHeaderInjection($header, $value)
+    {
+        foreach ([$header, $value] as $part) {
+            if (!\is_string($part)) {
+                continue;
+            }
+
+            if (false !== \strpbrk($part, "\r\n") || false !== \strpos($part, "\0")) {
+                throw new Exception\InvalidArgumentException(
+                    'Header names and values may not contain CR, LF or NUL characters.'
+                );
+            }
+        }
+    }
+
     /**
      * @param 'delete'|'get'|'post' $method
      * @param string $url
@@ -678,6 +743,7 @@ static function ($key) use ($params) {
             }
         }
 
+        self::validatePath($url);
         $absUrl = $this->_apiBase . $url;
         if ('v1' === $apiMode) {
             $params = self::_encodeObjects($params);
@@ -716,6 +782,7 @@ static function ($key) use ($params) {
         $rawHeaders = [];
 
         foreach ($combinedHeaders as $header => $value) {
+            self::assertNoHeaderInjection($header, $value);
             $rawHeaders[] = $header . ': ' . $value;
         }
 

lib/Treasury/OutboundPayment.php

@@ -39,6 +39,8 @@ class OutboundPayment extends \Stripe\ApiResource
 {
     const OBJECT_NAME = 'treasury.outbound_payment';
 
+    const PURPOSE_PAYROLL = 'payroll';
+
     const STATUS_CANCELED = 'canceled';
     const STATUS_FAILED = 'failed';
     const STATUS_POSTED = 'posted';

lib/V2/Billing/MeterEventAdjustment.php

@@ -22,4 +22,6 @@ class MeterEventAdjustment extends \Stripe\ApiResource
 
     const STATUS_COMPLETE = 'complete';
     const STATUS_PENDING = 'pending';
+
+    const TYPE_CANCEL = 'cancel';
 }

lib/V2/Core/EventNotification.php

@@ -118,7 +118,10 @@ public function fetchEvent()
     {
         $response = $this->client->rawRequest(
             'get',
-            "/v2/core/events/{$this->id}",
+            // `id` comes from the notification body, so encode it the way
+            // buildPath() does for generated services -- otherwise it can inject
+            // extra path or query segments.
+            '/v2/core/events/' . \urlencode($this->id),
             null,
             [
                 'stripe_context' => $this->context,